diff --git a/.beans/ATFS-xfg0--nix-flake-so-other-repos-tangled-workflows-can-run.md b/.beans/ATFS-xfg0--nix-flake-so-other-repos-tangled-workflows-can-run.md
index a9b1443..3c848ec 100644
--- a/.beans/ATFS-xfg0--nix-flake-so-other-repos-tangled-workflows-can-run.md
+++ b/.beans/ATFS-xfg0--nix-flake-so-other-repos-tangled-workflows-can-run.md
@@ -70,9 +70,14 @@ tagged tree cannot be stale, by construction.
 - [x] `.tangled/workflows/flake.yml` — the per-PR gate, and where `vendorHash` is read from
 - [x] README: how to get the CLI, both engines' YAML, and the `refs/tags/` rule
 - [x] CLAUDE.md sharp edges: the `refs/heads/` expansion, the derived `vendorHash`, the fileset
-- [ ] `vendorHash` filled in from that workflow's first run
+- [x] `vendorHash` filled in from that workflow's first run
 - [ ] `flake.lock`, committed — it's what makes a downstream pin reproducible
 
+The ritual worked exactly as written: `flake.yml`'s first run on main failed
+in the `-go-modules` derivation with `got: sha256-nvv3Pgtn…`, which is now the
+committed hash. The lock still needs a run that gets past that point to print
+it.
+
 The last two can only come from a machine with nix, which the dev box isn't;
 `flake.yml` prints both, so they land as a second commit on this branch once
 it has run once.
diff --git a/flake.nix b/flake.nix
index 7399bd7..6173797 100644
--- a/flake.nix
+++ b/flake.nix
@@ -82,7 +82,7 @@
 
           # Derived, never authored by hand — see .tangled/workflows/flake.yml,
           # which is where the real value is read from.
-          vendorHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+          vendorHash = "sha256-nvv3PgtnQV0svPS6ypNYUuLDYxU17ldgsmL05R6pRiA=";
 
           subPackages = [ "cmd/atfs" ];